Starstruk Logo MarkStarstruk

v0.6.8

Rheosoph/flow-likev0.6.8May 12, 2026by jaberjaber23

AI Summary

Enhances workspace isolation, introduces agent tools for skills, and adds an audit API alongside a new Requesty provider.

Key Highlights

  • Workspace state split to keep private state under ~/.openfang/
  • New agent tools: skill_list, skill_describe, skill_execute
  • POST /api/audit/append endpoint and HAND.toml SHA-256 Merkle audit chain
  • Requesty provider added with 5 catalog entries
  • Environment overrides for local providers (OLLAMA, LMSTUDIO, etc.)

New Features

  • skill_list tool
  • skill_describe tool
  • skill_execute tool
  • Audit append endpoint
  • Requesty provider

Full Release Notes

**Fixes:**
- #1097 workspace state_dir split — private state stays under `~/.openfang/`, user workspace untouched
- #1085 dashboard WS auth aligned with HTTP middleware
- #1038 `skill_list` / `skill_describe` / `skill_execute` agent tools (replaces filesystem fallback)
- #1170 `require_signed` wired through `POST /api/skills/install` with `allowed_signer_keys` allow-list
- #1174 `POST /api/audit/append` endpoint for instance-side wrapper audit integration
- #1172 HAND.toml SHA-256 auto-logged to Merkle audit chain on every load
- #780 Telegram `message_thread_id` routing per-topic to named agents
- Codex audit findings on installer.rs binding check closed:
  - CRLF and UTF-8 BOM normalization on both sides of compare
  - `package.json` added to manifest candidate list
  - symlink and canonicalization escape protection
  - TOCTOU closed via private staging dir plus atomic rename

**Providers:**
- #995 Requesty added (`https://router.requesty.ai/v1`) with 5 catalog entries
- #1154 `OLLAMA_HOST` / `LMSTUDIO_HOST` / `VLLM_HOST` / `LEMONADE_HOST` env override for local providers

**PR dispositions:**
- closed: #1185, #1166, #1162, #1055, #1044, #1039, #969
- held pending external rebase: #1151, #997, #1093, #946 (all reviewed clean)
- author rework requested: #943 (IDOR on session endpoints)

**Tests:** 2696+ across 14 crates, 0 clippy warnings.